Skip to main content

Nextcloud Server CVE-2025-66510

| EUVDEUVD-2025-201451 MEDIUM
Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)
2025-12-05 security-advisories@github.com
Information Disclosure Debian Nextcloud Server Nextcloud
4.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.5 MEDIUM
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
EUVD ID Assigned
Mar 15, 2026 - 17:08 euvd
EUVD-2025-201451
Analysis Generated
Mar 15, 2026 - 17:08 vuln.today
Patch released
Mar 15, 2026 - 17:08 nvd
Patch available
CVE Published
Dec 05, 2025 - 17:16 nvd
MEDIUM 4.5

DescriptionGitHub Advisory

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.

AnalysisAI

A security vulnerability in Nextcloud Server (CVSS 4.5) that allows an authenticated user. Remediation should follow standard vulnerability management procedures. Vendor patch is available.

Technical ContextAI

Vulnerability type not specified by vendor. Affects Nextcloud Server.

RemediationAI

Apply the vendor-supplied patch immediately.

More in Nextcloud Server

View all
CVE-2023-26482 HIGH POC
8.8 Mar 30

Nextcloud server is an open source home cloud implementation. Rated high severity (CVSS 8.8), this vulnerability is remo
CVE-2023-48306 CRITICAL POC
9.8 Nov 21

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Rated critical severity (CVSS 9.8),
CVE-2016-9463 HIGH POC
8.1 Mar 28

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authenti
CVE-2023-28643 HIGH POC
8.8 Mar 30

Nextcloud server is an open source home cloud implementation. Rated high severity (CVSS 8.8), this vulnerability is remo
CVE-2020-8259 HIGH POC
8.1 Nov 16

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the
CVE-2020-8121 HIGH POC
8.1 Feb 04

A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. Rated high

CVE-2020-8154 HIGH POC
7.7 May 12

An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices

CVE-2023-28847 HIGH POC
7.5 Apr 25

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Rated high severity (CV
CVE-2023-25821 HIGH POC
7.5 Feb 25

Nextcloud is an Open Source private cloud software. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
CVE-2020-8183 HIGH POC
7.5 Nov 02

A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initi
CVE-2023-48239 HIGH POC
7.1 Nov 21

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Rated high severity (CVSS 7.1), thi
CVE-2020-8236 MEDIUM POC
6.8 Nov 02

A wrong configuration in Nextcloud Server 19.0.1 incorrectly made the user feel the passwordless WebAuthn is also a two

Same weakness CWE-359 – Exposure of Private Personal Information to an Unauthorized Actor

View all
CVE-2024-11396 MEDIUM POC
5.3
CVE-2022-0482 CRITICAL POC
9.1
CVE-2025-54125 HIGH POC
8.7
CVE-2022-2921 HIGH POC
8.8
CVE-2019-25762 HIGH POC
8.7
CVE-2024-10267 HIGH POC
7.5
CVE-2020-37173 HIGH POC
7.5
CVE-2025-65857 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

Debian

Bug #941708
nextcloud-server
Release Status Fixed Version Urgency
open - -

Share

CVE-2025-66510 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy